General information, not legal advice

Laws and rules change and depend on your situation. Before acting on anything here that could affect your rights or immigration status, confirm with a qualified attorney or an accredited legal representative.

In plain words

HIPAA (the Health Insurance Portability and Accountability Act) is the US law that requires health providers to keep your medical information private. Without your written permission, your doctor or clinic generally cannot share your records with your employer, your family members, or government agencies that are not involved in your direct medical care.

Telling someone about your mental health is hard enough. Knowing who can see what you share can make it easier to be honest. In the United States a federal law called HIPAA protects your health information, and it works in your favor.

At a glance
  • HIPAA limits who your clinic can share your health information with, and generally requires your written permission.
  • Your therapy session notes get extra protection, and drug or alcohol treatment records are protected more strictly still.
  • You have the right to see and get a copy of your own records and to ask for corrections.
  • A clinic is not an immigration office, and HIPAA limits what it can share about you.

What HIPAA protects

HIPAA is the Health Insurance Portability and Accountability Act. It sets rules that doctors, clinics, hospitals, and health plans must follow to keep your identifiable health information private. Under these rules they generally cannot use or share your information without your written permission, except for a few specific purposes the law allows, such as treating you, getting paid for your care, and running the clinic. The HHS Office for Civil Rights explains what you can expect on its Your Rights Under HIPAA page.

At your first visit, a clinic will usually give you a paper called a Notice of Privacy Practices. It explains how the clinic may use your information and lists your rights. You can ask for it in your language, and you can ask an interpreter to read it with you. Signing that you received the notice is not the same as agreeing to share your records; it only means you got the paper.

Mental health notes get extra protection

The private notes a therapist keeps about your sessions, called psychotherapy notes, are protected more strictly than the rest of your record. These are the therapist’s personal notes analyzing your conversation, kept separate from your main file. A provider must get your specific, separate permission to share them, even with another provider (HHS). HHS describes how HIPAA applies to mental and behavioral health on its mental health information page.

Not everything from your therapy is a psychotherapy note. The extra-protected notes do not include the basic parts of your record that any care needs, such as what medicine you were prescribed, how long the session was, your diagnosis, your treatment plan, and how you are progressing (HHS). Those parts follow the normal HIPAA rules.

Extra privacy for drug and alcohol treatment

Care for a drug or alcohol problem has its own, stronger protection under a federal rule usually called Part 2 (42 CFR Part 2). Records from most substance use treatment programs generally cannot be shared without your written consent, with only narrow exceptions (HHS). This extra layer exists so that fear of being exposed does not stop people from getting help. If you are worried about privacy when seeking help for drinking or drug use, know that these records are treated with special care.

Your rights over your own record

  • You can see and get a copy of your medical records.
  • You can ask to correct information you think is wrong.
  • You can ask for a list of certain times your information was shared.
  • Your information is shared with family members or other people only if you agree, except in narrow safety situations.

Sharing only what a step needs

You do not have to tell every office your whole story at once. When a form or a step asks for information, it is fine to give only what that step actually needs. If you are unsure why something is being asked, you can ask why the information is needed and how it will be used before you answer. Sharing less is a normal and reasonable choice.

Clinics and immigration

A clinic is a place that provides health care, not an immigration office. Providers should not require you to give your immigration status in order to be treated, and HIPAA limits what they can share about you.

A clinic is not an immigration office

In general, your clinic needs your written permission before it shares your records with anyone outside your care, including government agencies. HIPAA does not require a clinic to ask about or report your immigration status.

In general, your clinic needs your written permission before it shares your records with anyone outside your care, including government agencies. HIPAA does not require a clinic to ask about or report your immigration status. There are a few narrow situations where a clinic may share limited information with law enforcement without your permission, such as when a court orders it or a specific law requires it, and even then it is supposed to share only the least information needed (HHS). If you have a specific worry about your records connected to a legal or immigration case, that is a question for a person, such as a legal aid organization or a navigator, and not for an app. LINC will connect you with a person for questions like these.

You can read it in your language

You have the right to receive the clinic’s privacy notice and any form that asks permission to share your records in a language you understand, and to have an interpreter go through it with you, under Section 1557’s language-access rules. Do not sign a permission form you do not understand.

Watch out

Do not sign a permission form you do not understand. You have the right to the clinic's privacy notice and any release form in a language you understand, and to have an interpreter go through it with you first.

If you believe your privacy was violated, you can file a complaint with the HHS Office for Civil Rights. You can file online at ocrportal.hhs.gov or read how at hhs.gov/civil-rights/filing-a-complaint. Filing is free, you do not need a lawyer, and it is usually best to do it within 180 days of when the problem happened.

This can vary by state

HIPAA is the national floor, and some states add stronger privacy protections, especially for mental health and substance use records, so the exact rules on what a clinic may share can differ where you live. It is worth checking your state. For language access in particular, your state Medicaid office can tell you what interpreter services are covered, which affect your right to understand a privacy notice in your own language.

How to get a copy of your records

Your right to see your records only helps if you know how to use it. Here is what usually works:

How to get a copy of your records
  • Ask in writing, using the clinic's "medical records request" or "release of information" form.
  • You do not have to say why you want your own records.
  • In most cases a provider has to give you your records within 30 days.
  • A reasonable, cost-based copying fee is allowed, but they cannot make you pay old medical bills first.
  • You can get them electronically and ask them to send a copy to another provider or a person you name.
  • If something is wrong, ask in writing to correct it, or to add your written disagreement to the record.

If a form or a request is in English only, you can ask for it in your language and for an interpreter to go through it with you before you sign.

Sources

LINC is a research prototype, not a medical or legal service. Translation can be wrong; you have the right to a free, qualified interpreter. For anything high-stakes, do it with a community health worker or someone you trust. In a crisis, call or text 988, or 911 for immediate danger.